diff --git a/drivers/staging/qcacld-3.0/Android.mk b/drivers/staging/qcacld-3.0/Android.mk
index e38633439607..4d4332860cd3 100644
--- a/drivers/staging/qcacld-3.0/Android.mk
+++ b/drivers/staging/qcacld-3.0/Android.mk
@@ -146,6 +146,37 @@ ifneq ($(WLAN_KBUILD_OPTIONS_$(LOCAL_DEV_NAME)),)
 KBUILD_OPTIONS += "$(WLAN_KBUILD_OPTIONS_$(LOCAL_DEV_NAME))"
 endif
 
+##########################################################
+# Copy the unstrip file and corresponding elf file to  out symbols folders
+WLAN_SYMBOLS_OUT     := $(TARGET_OUT_UNSTRIPPED)/$(LOCAL_PATH)
+UNSTRIPPED_MODULE    := $(WLAN_CHIPSET)_$(LOCAL_DEV_NAME).ko.unstripped
+UNSTRIPPED_FILE_PATH := $(TARGET_OUT_INTERMEDIATES)/$(LOCAL_PATH)/$(UNSTRIPPED_MODULE)
+
+INSTALL_WLAN_UNSTRIPPED_MODULE := mkdir -p $(WLAN_SYMBOLS_OUT); \
+   cp -rf $(UNSTRIPPED_FILE_PATH) $(WLAN_SYMBOLS_OUT);
+
+ifneq ($(filter msm8998 sdm845 sdm670 sdm710, $(TARGET_BOARD_PLATFORM)),)
+    WLAN_ELF_FILE_PATH    := vendor/qcom/nonhlos/wlan_proc/build/ms/WLAN_MERGED.elf
+else ifneq ($(filter sdm660, $(TARGET_BOARD_PLATFORM)),)
+    WLAN_ELF_FILE_PATH    := vendor/qcom/nonhlos/WLAN.HL.1.0.1/wlan_proc/build/ms/WLAN_MERGED.elf
+else ifneq ($(filter sm6150, $(TARGET_BOARD_PLATFORM)),)
+    WLAN_ELF_FILE_PATH    := vendor/qcom/nonhlos/WLAN.HL.3.0.1/wlan_proc/build/ms/*.elf
+else ifneq ($(filter trinket, $(TARGET_BOARD_PLATFORM)),)
+    WLAN_ELF_FILE_PATH    := vendor/qcom/nonhlos/WLAN.HL.3.0.2/wlan_proc/build/ms/WLAN_MERGED.elf
+else ifneq ($(filter lito, $(TARGET_BOARD_PLATFORM)),)
+    WLAN_ELF_FILE_PATH    := vendor/qcom/nonhlos/WLAN.HL.3.3.1/wlan_proc/build/ms/Msaipan_WLAN_MERGED.elf
+else ifneq ($(filter bengal, $(TARGET_BOARD_PLATFORM)),)
+    WLAN_ELF_FILE_PATH    := vendor/qcom/nonhlos/WLAN.HL.3.2.4/wlan_proc/build/ms/WLAN_MERGED.elf
+else ifneq ($(filter holi, $(TARGET_BOARD_PLATFORM)),)
+    XML_PATH := vendor/qcom/nonhlos/$(NONHLOS_PLATFORM_COMMON_PATH)
+    ELF_PATH := $(shell python3 $(LOCAL_PATH)/get_value_from_xml.py $(XML_PATH)/contents.xml)
+    WLAN_ELF_FILE_PATH := $(XML_PATH)/$(ELF_PATH)wlan_proc/build/ms/*.elf
+endif
+
+ifneq ($(WLAN_ELF_FILE_PATH),)
+   INSTALL_WLAN_UNSTRIPPED_MODULE += cp -rf $(WLAN_ELF_FILE_PATH) $(WLAN_SYMBOLS_OUT)
+endif
+
 include $(CLEAR_VARS)
 LOCAL_MODULE              := $(WLAN_CHIPSET)_$(LOCAL_DEV_NAME).ko
 LOCAL_MODULE_KBUILD_NAME  := $(LOCAL_MOD_NAME).ko
@@ -160,6 +191,9 @@ else
     LOCAL_MODULE_PATH := $(TARGET_OUT)/lib/modules/$(WLAN_CHIPSET)
 endif
 
+# Once unstripped file is generated, copy the same to out symbols folder
+LOCAL_POST_INSTALL_CMD := $(INSTALL_WLAN_UNSTRIPPED_MODULE)
+
 include $(DLKM_DIR)/AndroidKernelModule.mk
 ###########################################################
 
@@ -184,6 +218,11 @@ endif
 
 $(shell mkdir -p $(TARGET_FW_PATH); \
 	ln -sf $(TARGET_MAC_BIN_PATH)/wlan_mac.bin $(TARGET_FW_PATH)/wlan_mac.bin)
+
+# BEGIN IKSWR-45692, support loading moto specific configurations
+$(shell ln -sf $(TARGET_CFG_PATH)/WCNSS_mot_cfg.ini $(TARGET_FW_PATH)/WCNSS_mot_cfg.ini)
+# END IKSWR-45692
+
 ifneq ($(GENERIC_ODM_IMAGE),true)
 $(shell ln -sf $(TARGET_CFG_PATH)/WCNSS_qcom_cfg.ini $(TARGET_FW_PATH)/WCNSS_qcom_cfg.ini)
 endif
diff --git a/drivers/staging/qcacld-3.0/Kbuild b/drivers/staging/qcacld-3.0/Kbuild
index 72ebf8f3e425..d3df87546db4 100644
--- a/drivers/staging/qcacld-3.0/Kbuild
+++ b/drivers/staging/qcacld-3.0/Kbuild
@@ -3076,6 +3076,13 @@ cppflags-$(CONFIG_QCA_WIFI_FTM) += -DQCA_WIFI_FTM
 cppflags-$(CONFIG_NL80211_TESTMODE) += -DQCA_WIFI_FTM_NL80211
 cppflags-$(CONFIG_LINUX_QCMBR) += -DLINUX_QCMBR -DQCA_WIFI_FTM_IOCTL
 
+# WLAN_WHITE_LIST - WLAN Radiated Power Test
+# For user software build, wlan driver needs to allow the factory
+# commnds only for Tx_opcode and NART commands based off 12M doc
+ifeq ($(TARGET_BUILD_VARIANT),user)
+CDEFINES += -DWLAN_WHITE_LIST
+endif
+
 #Enable Checksum Offload support
 cppflags-$(CONFIG_CHECKSUM_OFFLOAD) += -DCHECKSUM_OFFLOAD
 
@@ -3419,6 +3426,8 @@ cppflags-$(CONFIG_WLAN_HANG_EVENT) += -DHIF_BUS_LOG_INFO
 cppflags-$(CONFIG_WLAN_HANG_EVENT) += -DDP_SUPPORT_RECOVERY_NOTIFY
 #endof dummy flags
 
+cppflags-y += -DMOTO_UTAGS_MAC
+
 ccflags-$(CONFIG_ENABLE_SIZE_OPTIMIZE) += -Os
 
 # DFS component
diff --git a/drivers/staging/qcacld-3.0/NOTICE b/drivers/staging/qcacld-3.0/NOTICE
new file mode 100644
index 000000000000..cab58c63efb4
--- /dev/null
+++ b/drivers/staging/qcacld-3.0/NOTICE
@@ -0,0 +1,21 @@
+Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
+
+Previously licensed under the ISC license by Qualcomm Atheros, Inc.
+
+Permission to use, copy, modify, and/or distribute this software for
+any purpose with or without fee is hereby granted, provided that the
+above copyright notice and this permission notice appear in all
+copies.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL
+WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED
+WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE
+AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL
+DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR
+PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER
+TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+PERFORMANCE OF THIS SOFTWARE.
+
+This file was originally distributed by Qualcomm Atheros, Inc.
+under proprietary terms before Copyright ownership was assigned
+to the Linux Foundation.
diff --git a/drivers/staging/qcacld-3.0/components/cmn_services/policy_mgr/src/wlan_policy_mgr_tables_no_dbs_i.h b/drivers/staging/qcacld-3.0/components/cmn_services/policy_mgr/src/wlan_policy_mgr_tables_no_dbs_i.h
index 50dacf8009e8..93d7e7dedd5f 100644
--- a/drivers/staging/qcacld-3.0/components/cmn_services/policy_mgr/src/wlan_policy_mgr_tables_no_dbs_i.h
+++ b/drivers/staging/qcacld-3.0/components/cmn_services/policy_mgr/src/wlan_policy_mgr_tables_no_dbs_i.h
@@ -33,7 +33,7 @@ second_connection_pcl_nodbs_table[PM_MAX_ONE_CONNECTION_MODE]
 	[PM_STA_MODE] = {PM_5G, PM_SCC_CH, PM_SCC_CH},
 	[PM_SAP_MODE] = {PM_SCC_CH_5G, PM_SCC_CH, PM_SCC_CH_5G},
 	[PM_P2P_CLIENT_MODE] = {PM_SCC_CH, PM_SCC_CH, PM_SCC_CH_5G},
-	[PM_P2P_GO_MODE] = {PM_5G, PM_SCC_CH, PM_SCC_CH_5G},
+	[PM_P2P_GO_MODE] = {PM_SCC_CH, PM_SCC_CH, PM_SCC_CH_5G},
 	[PM_NAN_DISC_MODE] = {PM_NONE, PM_NONE, PM_NONE},
 	[PM_NDI_MODE] = {PM_MAX_PCL_TYPE, PM_MAX_PCL_TYPE, PM_MAX_PCL_TYPE} },
 
@@ -41,7 +41,7 @@ second_connection_pcl_nodbs_table[PM_MAX_ONE_CONNECTION_MODE]
 	[PM_STA_MODE] = {PM_5G, PM_SCC_CH, PM_SCC_CH},
 	[PM_SAP_MODE] = {PM_SCC_CH_5G, PM_SCC_CH, PM_SCC_CH_5G},
 	[PM_P2P_CLIENT_MODE] = {PM_SCC_CH, PM_SCC_CH, PM_SCC_CH_5G},
-	[PM_P2P_GO_MODE] = {PM_5G, PM_SCC_CH, PM_SCC_CH_5G},
+	[PM_P2P_GO_MODE] = {PM_SCC_CH, PM_SCC_CH, PM_SCC_CH_5G},
 	[PM_NAN_DISC_MODE] = {PM_NONE, PM_NONE, PM_NONE},
 	[PM_NDI_MODE] = {PM_MAX_PCL_TYPE, PM_MAX_PCL_TYPE, PM_MAX_PCL_TYPE} },
 
diff --git a/drivers/staging/qcacld-3.0/core/dp/txrx/ol_rx_defrag.c b/drivers/staging/qcacld-3.0/core/dp/txrx/ol_rx_defrag.c
index fc5d50bb061b..5a225e1606e1 100644
--- a/drivers/staging/qcacld-3.0/core/dp/txrx/ol_rx_defrag.c
+++ b/drivers/staging/qcacld-3.0/core/dp/txrx/ol_rx_defrag.c
@@ -453,6 +453,28 @@ ol_rx_reorder_store_frag(ol_txrx_pdev_handle pdev,
 		return;
 	}
 
+	rx_desc = htt_rx_msdu_desc_retrieve(htt_pdev, frag);
+	qdf_assert(htt_rx_msdu_has_wlan_mcast_flag(htt_pdev, rx_desc));
+	index = htt_rx_msdu_is_wlan_mcast(htt_pdev, rx_desc) ?
+		txrx_sec_mcast : txrx_sec_ucast;
+
+	/*
+	 * Multicast/Broadcast frames should not be fragmented so drop
+	 * such frames.
+	 */
+	if (index != txrx_sec_ucast) {
+		ol_rx_frames_free(htt_pdev, frag);
+		return;
+	}
+
+	if (peer->security[index].sec_type != htt_sec_type_none &&
+	    !htt_rx_mpdu_is_encrypted(htt_pdev, rx_desc)) {
+		ol_txrx_err("Unencrypted fragment received in security mode %d",
+			    peer->security[index].sec_type);
+		ol_rx_frames_free(htt_pdev, frag);
+		return;
+	}
+
 	if ((!more_frag) && (!fragno) && (!rx_reorder_array_elem->head)) {
 		rx_reorder_array_elem->head = frag;
 		rx_reorder_array_elem->tail = frag;
diff --git a/drivers/staging/qcacld-3.0/core/dp/txrx/ol_rx_pn.c b/drivers/staging/qcacld-3.0/core/dp/txrx/ol_rx_pn.c
index 0d8d71584588..58d4cf6b4aa5 100644
--- a/drivers/staging/qcacld-3.0/core/dp/txrx/ol_rx_pn.c
+++ b/drivers/staging/qcacld-3.0/core/dp/txrx/ol_rx_pn.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011, 2013-2017, 2019-2021 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011, 2013-2017, 2019, 2021 The Linux Foundation. All rights reserved.
  *
  * Permission to use, copy, modify, and/or distribute this software for
  * any purpose with or without fee is hereby granted, provided that the
diff --git a/drivers/staging/qcacld-3.0/core/dp/txrx/ol_txrx.c b/drivers/staging/qcacld-3.0/core/dp/txrx/ol_txrx.c
index feafa1727c72..c3250538198a 100644
--- a/drivers/staging/qcacld-3.0/core/dp/txrx/ol_txrx.c
+++ b/drivers/staging/qcacld-3.0/core/dp/txrx/ol_txrx.c
@@ -1449,6 +1449,15 @@ ol_txrx_pdev_post_attach(struct cdp_soc_t *soc_hdl, uint8_t pdev_id)
 	 */
 	qdf_mem_zero(&pdev->rx_pn[0], sizeof(pdev->rx_pn));
 
+	/* WEP: 24-bit PN */
+	pdev->rx_pn[htt_sec_type_wep40].len =
+		pdev->rx_pn[htt_sec_type_wep104].len =
+			pdev->rx_pn[htt_sec_type_wep128].len = 24;
+
+	pdev->rx_pn[htt_sec_type_wep40].cmp =
+		pdev->rx_pn[htt_sec_type_wep104].cmp =
+			pdev->rx_pn[htt_sec_type_wep128].cmp = ol_rx_pn_cmp24;
+
 	/* TKIP: 48-bit TSC, CCMP: 48-bit PN */
 	pdev->rx_pn[htt_sec_type_tkip].len =
 		pdev->rx_pn[htt_sec_type_tkip_nomic].len =
diff --git a/drivers/staging/qcacld-3.0/core/hdd/inc/qc_sap_ioctl.h b/drivers/staging/qcacld-3.0/core/hdd/inc/qc_sap_ioctl.h
index f460b40a1478..b10fb0dba83a 100644
--- a/drivers/staging/qcacld-3.0/core/hdd/inc/qc_sap_ioctl.h
+++ b/drivers/staging/qcacld-3.0/core/hdd/inc/qc_sap_ioctl.h
@@ -89,6 +89,9 @@ struct channel_list_info {
 
 #define WE_SET_THERMAL_THROTTLE_CFG     27
 
+/* for moto SAR features, support tx pwr limit settings on mimo device */
+#define WE_SET_MIMO_TX_POWER 32
+
 #define WE_P2P_NOA_CMD  2
 
 #define QCSAP_IOCTL_MODIFY_ACL          (SIOCIWFIRSTPRIV + 18)
diff --git a/drivers/staging/qcacld-3.0/core/hdd/inc/wlan_hdd_cfg.h b/drivers/staging/qcacld-3.0/core/hdd/inc/wlan_hdd_cfg.h
index ac603fe5614d..13d2e62a2734 100644
--- a/drivers/staging/qcacld-3.0/core/hdd/inc/wlan_hdd_cfg.h
+++ b/drivers/staging/qcacld-3.0/core/hdd/inc/wlan_hdd_cfg.h
@@ -279,6 +279,11 @@ struct hdd_config {
 eCsrRoamWmmUserModeType hdd_to_csr_wmm_mode(uint8_t mode);
 
 QDF_STATUS hdd_update_mac_config(struct hdd_context *hdd_ctx);
+#ifdef MOTO_UTAGS_MAC
+QDF_STATUS hdd_update_mac_serial(struct hdd_context *hdd_ctx);
+QDF_STATUS hdd_generate_random_mac_from_serialno(char *serialNo,
+                     int serialength, char *computedMac);
+#endif
 QDF_STATUS hdd_set_sme_config(struct hdd_context *hdd_ctx);
 QDF_STATUS hdd_set_policy_mgr_user_cfg(struct hdd_context *hdd_ctx);
 QDF_STATUS hdd_set_sme_chan_list(struct hdd_context *hdd_ctx);
diff --git a/drivers/staging/qcacld-3.0/core/hdd/inc/wlan_hdd_misc.h b/drivers/staging/qcacld-3.0/core/hdd/inc/wlan_hdd_misc.h
index b105df1b3a98..f018d2efc3e4 100644
--- a/drivers/staging/qcacld-3.0/core/hdd/inc/wlan_hdd_misc.h
+++ b/drivers/staging/qcacld-3.0/core/hdd/inc/wlan_hdd_misc.h
@@ -44,6 +44,9 @@
 #ifdef MSM_PLATFORM
 #define WLAN_INI_FILE              "wlan/qca_cld/" PREFIX "WCNSS_qcom_cfg.ini"
 #define WLAN_MAC_FILE              "wlan/qca_cld/" PREFIX "wlan_mac.bin"
+// BEGIN IKSWR-45692, support loading moto specific configurations
+#define WLAN_MOT_INI_FILE              "wlan/qca_cld/" PREFIX "WCNSS_mot_cfg.ini"
+// END IKSWR-45692
 #else
 #define WLAN_INI_FILE              "wlan/" PREFIX "qcom_cfg.ini"
 #define WLAN_MAC_FILE              "wlan/" PREFIX "wlan_mac.bin"
diff --git a/drivers/staging/qcacld-3.0/core/hdd/src/wlan_hdd_cfg.c b/drivers/staging/qcacld-3.0/core/hdd/src/wlan_hdd_cfg.c
old mode 100644
new mode 100755
index 9e8f348016ad..7bc77b604267
--- a/drivers/staging/qcacld-3.0/core/hdd/src/wlan_hdd_cfg.c
+++ b/drivers/staging/qcacld-3.0/core/hdd/src/wlan_hdd_cfg.c
@@ -51,6 +51,152 @@
 #include <wma_api.h>
 #include "wlan_hdd_object_manager.h"
 
+#ifdef MOTO_UTAGS_MAC
+#include <linux/of.h>
+#include <linux/of_address.h>
+#include <crypto/md5.h>
+#include <crypto/hash.h>
+
+#define WIFI_MAC_BOOTARG "wifimacaddr="
+#define DEVICE_SERIALNO_BOOTARG "androidboot.serialno="
+#define MACSTRLEN 12
+
+struct sdesc {
+   struct shash_desc shash;
+   char ctx[];
+};
+
+QDF_STATUS hdd_update_mac_serial(struct hdd_context *hdd_ctx)
+{
+    QDF_STATUS qdf_status = QDF_STATUS_SUCCESS;
+
+    int len = 0;
+    int serialnoLen = 0;
+
+    char *buffer = NULL;
+    char *bufferPtr = NULL;
+    char *computedMac = NULL;
+    const char *cmd_line = NULL;
+    tSirMacAddr mac_addr;
+
+    struct device_node *chosen_node = NULL;
+    computedMac = (char*)qdf_mem_malloc(QDF_MAC_ADDR_SIZE);
+
+    chosen_node = of_find_node_by_name(NULL, "chosen");
+    hdd_err("%s: get chosen node \n", __func__);
+
+    if (!chosen_node)
+    {
+        hdd_err("%s: get chosen node read failed \n", __func__);
+        goto config_exit;
+    } else {
+        cmd_line = of_get_property(chosen_node, "bootargs", &len);
+        if (!cmd_line || len <= 0) {
+            hdd_err("%s: get the barcode bootargs failed \n", __func__);
+            qdf_status = QDF_STATUS_E_FAILURE;
+            goto config_exit;
+        } else {
+            buffer = strstr(cmd_line, DEVICE_SERIALNO_BOOTARG);
+            if (buffer == NULL) {
+                hdd_err("%s: " DEVICE_SERIALNO_BOOTARG" not present cmd line argc",
+                                                                    __func__);
+                qdf_status = QDF_STATUS_E_FAILURE;
+                goto config_exit;
+            } else {
+                buffer += strlen(DEVICE_SERIALNO_BOOTARG);
+                bufferPtr = buffer;
+                while (*bufferPtr != ' ') {
+                    bufferPtr++;
+                    serialnoLen = serialnoLen + 1;
+                }
+            }
+        }
+    }
+    /*Data have been read from boot serial no     */
+    /*Now generate random unique the 6 byte string */
+    if (hdd_generate_random_mac_from_serialno(buffer, serialnoLen,
+                computedMac) != QDF_STATUS_SUCCESS) {
+        qdf_status = QDF_STATUS_E_FAILURE;
+        goto config_exit;
+    }
+    qdf_mem_copy(&hdd_ctx->provisioned_mac_addr[0].bytes[0],
+                       (uint8_t *)computedMac, QDF_MAC_ADDR_SIZE);
+    qdf_mem_copy(&mac_addr, &hdd_ctx->provisioned_mac_addr[0].bytes[0],
+		    sizeof(tSirMacAddr));
+    hdd_ctx->num_provisioned_addr = 1; // Only one address was generated
+    hdd_populate_random_mac_addr(hdd_ctx, QDF_MAX_CONCURRENCY_PERSONA - 1);
+    sme_set_custom_mac_addr(mac_addr);
+config_exit:
+    qdf_mem_free(computedMac);
+    return qdf_status;
+}
+
+QDF_STATUS hdd_generate_random_mac_from_serialno(char *serialNo, int serialnoLen,
+                                                                  char *macAddr)
+{
+    unsigned int size;
+    struct crypto_shash *md5;
+    struct sdesc *sdescmd5;
+    char *hashBuf = NULL;
+
+    QDF_STATUS cryptoStatus = QDF_STATUS_SUCCESS;
+    hashBuf = (char*)qdf_mem_malloc(16);
+
+    /*Motorola OUI*/
+    macAddr[0] = 0x38;
+    macAddr[1] = 0x80;
+    macAddr[2] = 0xDF;
+
+    md5 = crypto_alloc_shash("md5", 0, 0);
+    if (IS_ERR(md5)) {
+        cryptoStatus = QDF_STATUS_E_FAILURE;
+        hdd_err("%s: Crypto md5 allocation error \n", __func__);
+        qdf_mem_free(hashBuf);
+        return QDF_STATUS_E_FAILURE;
+    }
+
+    size = sizeof(struct shash_desc) + crypto_shash_descsize(md5);
+
+    sdescmd5 = kmalloc(size, GFP_KERNEL);
+    if (!sdescmd5) {
+        cryptoStatus = QDF_STATUS_E_FAILURE;
+        hdd_err("%s: Memory allocation error \n", __func__);
+        goto crypto_hash_err;
+    }
+
+    sdescmd5->shash.tfm = md5;
+
+    if (crypto_shash_init(&sdescmd5->shash)) {
+        cryptoStatus = QDF_STATUS_E_FAILURE;
+        goto crypto_hash_err;
+    }
+
+    if (crypto_shash_update(&sdescmd5->shash, serialNo, serialnoLen)) {
+        cryptoStatus = QDF_STATUS_E_FAILURE;
+        goto crypto_hash_err;
+    }
+
+    if (crypto_shash_final(&sdescmd5->shash, &hashBuf[0])) {
+        cryptoStatus = QDF_STATUS_E_FAILURE;
+        goto crypto_hash_err;
+    }
+
+    macAddr[3] = hashBuf[0];
+    macAddr[4] = hashBuf[1];
+    macAddr[5] = hashBuf[2];
+
+    hdd_err("%02X:%02X:%02X:%02X:%02X:%02X is the new MAC generated from serial number \n", macAddr[0],
+                                             macAddr[1], macAddr[2], macAddr[3],
+                                                        macAddr[4], macAddr[5]);
+    crypto_hash_err:
+    qdf_mem_free(hashBuf);
+    crypto_free_shash(md5);
+    kfree(sdescmd5);
+
+    return cryptoStatus;
+}
+#else
+
 /**
  * get_next_line() - find and locate the new line pointer
  * @str: pointer to string
@@ -128,6 +274,8 @@ static char *i_trim(char *str)
 	return str;
 }
 
+#endif
+
 /** struct hdd_cfg_entry - ini configuration entry
  * @name: name of the entry
  * @value: value of the entry
@@ -246,6 +394,7 @@ static void hdd_set_power_save_offload_config(struct hdd_context *hdd_ctx)
  * Return: QDF_STATUS_SUCCESS if the MAC address is found from cfg file
  *      and overwritten, otherwise QDF_STATUS_E_INVAL
  */
+#ifndef MOTO_UTAGS_MAC
 QDF_STATUS hdd_update_mac_config(struct hdd_context *hdd_ctx)
 {
 	int status, i = 0;
@@ -363,6 +512,100 @@ config_exit:
 	return qdf_status;
 }
 
+#else
+QDF_STATUS hdd_update_mac_config(struct hdd_context *hdd_ctx)
+{
+	int len = 0;
+	int i = 0;
+	int intf = 0;
+	char *bufferPtr = NULL;
+	char name[QDF_MAX_CONCURRENCY_PERSONA][16] = {{0}};
+	char buffer_temp[QDF_MAX_CONCURRENCY_PERSONA][MACSTRLEN+1] = {{0}};
+	const char *cmd_line = NULL;
+	struct device_node *chosen_node = NULL;
+	char *buffer = NULL;
+
+	struct hdd_cfg_entry macTable[QDF_MAX_CONCURRENCY_PERSONA];
+	tSirMacAddr customMacAddr;
+
+	QDF_STATUS qdf_status = QDF_STATUS_SUCCESS;
+
+	memset(macTable, 0, sizeof(macTable));
+
+	/*Implemenation of QCOM is to read the MAC address from the predefined*/
+	/*location where WLAN MMAC File have the MAC Address                  */
+	/* Read MACs from bootparams. */
+	chosen_node = of_find_node_by_name(NULL, "chosen");
+	hdd_err("%s: get chosen node \n", __func__);
+	if (!chosen_node)
+	{
+		hdd_err("%s: get chosen node read failed \n", __func__);
+		goto config_exit;
+	} else {
+		cmd_line = of_get_property(chosen_node, "bootargs", &len);
+
+		if (!cmd_line || len <= 0) {
+			hdd_err("%s: get wlan MACs bootargs failed \n", __func__);
+			qdf_status = QDF_STATUS_E_FAILURE;
+			goto config_exit;
+		} else {
+			buffer = strstr(cmd_line, WIFI_MAC_BOOTARG);
+			if (buffer == NULL) {
+				hdd_err("%s: " WIFI_MAC_BOOTARG " bootarg cmd line is null", __func__);
+				qdf_status = QDF_STATUS_E_FAILURE;
+				goto config_exit;
+			} else {
+				buffer += strlen(WIFI_MAC_BOOTARG);
+				bufferPtr = buffer;
+			}
+		}
+	}
+	/* Mac address data format used by qcom:
+	* Intf0MacAddress=00AA00BB00CC
+	* Intf1MacAddress=00AA00BB00CD
+	* xxxxxxxxxxxxxxxxxxxxxxxxxxxx
+	* Intf0MacAddress used for 1 macaddress
+	* if gp2pdeviceAdmistered is set to 1
+	* if s020deviceAdmisnited is set to 0
+	* it will use Intf1MacAddress for P2P seprately
+	* Motorola decided to use gp2pdeviceAdmistered = 1 i.e use
+	* locally gerated bin MAC addr for P2P
+	* From bootarg we need to strip off : from macaddress
+	*/
+	while (*bufferPtr != '\0' && *bufferPtr != ' ') {
+		if (*bufferPtr != ':' && *bufferPtr != ',') {
+			buffer_temp[intf][i++] = *bufferPtr;
+			if (i == MACSTRLEN) {
+				buffer_temp[intf][i] = '\0';
+				sprintf(name[intf], "Intf%dMacAddress", intf);
+				macTable[intf].name = name[intf];
+				macTable[intf].value = buffer_temp[intf];
+				i = 0;
+				intf++;
+				hdd_ctx->num_provisioned_addr++;
+				if (intf >= QDF_MAX_CONCURRENCY_PERSONA)
+					break;
+			}
+		}
+		bufferPtr++;
+	}
+
+	for (i = 0; i < intf; i++)
+		hdd_err("Mac address table from utag: [%s][%s]", macTable[i].name, macTable[i].value);
+
+	update_mac_from_string(hdd_ctx, &macTable[0], intf);
+	hdd_populate_random_mac_addr(hdd_ctx, QDF_MAX_CONCURRENCY_PERSONA - intf);
+	qdf_mem_copy(&customMacAddr, &hdd_ctx->provisioned_mac_addr[0].bytes[0],
+			sizeof(tSirMacAddr));
+	sme_set_custom_mac_addr(customMacAddr);
+
+config_exit:
+
+	return qdf_status;
+}
+
+#endif
+
 #ifdef FEATURE_RUNTIME_PM
 /**
  * hdd_disable_runtime_pm() - Override to disable runtime_pm.
diff --git a/drivers/staging/qcacld-3.0/core/hdd/src/wlan_hdd_cfg80211.c b/drivers/staging/qcacld-3.0/core/hdd/src/wlan_hdd_cfg80211.c
index 06fc6ce2f5be..e195f4025244 100644
--- a/drivers/staging/qcacld-3.0/core/hdd/src/wlan_hdd_cfg80211.c
+++ b/drivers/staging/qcacld-3.0/core/hdd/src/wlan_hdd_cfg80211.c
@@ -269,7 +269,7 @@ static const struct ieee80211_channel hdd_channels_2_4_ghz[] = {
 	HDD2GHZCHAN(2462, 11, 0),
 	HDD2GHZCHAN(2467, 12, 0),
 	HDD2GHZCHAN(2472, 13, 0),
-	HDD2GHZCHAN(2484, 14, 0),
+
 };
 
 static const struct ieee80211_channel hdd_channels_5_ghz[] = {
@@ -1944,7 +1944,7 @@ static int wlan_hdd_set_acs_ch_range(
 		sap_cfg->acs_cfg.start_ch_freq =
 				wlan_reg_ch_to_freq(CHAN_ENUM_2412);
 		sap_cfg->acs_cfg.end_ch_freq =
-				wlan_reg_ch_to_freq(CHAN_ENUM_2484);
+				wlan_reg_ch_to_freq(CHAN_ENUM_2472);
 	} else if (hw_mode == QCA_ACS_MODE_IEEE80211G) {
 		sap_cfg->acs_cfg.hw_mode = eCSR_DOT11_MODE_11g;
 		sap_cfg->acs_cfg.start_ch_freq =
@@ -18919,6 +18919,9 @@ static int __wlan_hdd_cfg80211_add_key(struct wiphy *wiphy,
 	cdp_peer_flush_frags(cds_get_context(QDF_MODULE_ID_SOC),
 			     wlan_vdev_get_id(vdev), mac_address.bytes);
 
+	cdp_peer_flush_frags(cds_get_context(QDF_MODULE_ID_SOC),
+			     wlan_vdev_get_id(vdev), mac_address.bytes);
+
 	switch (adapter->device_mode) {
 	case QDF_SAP_MODE:
 	case QDF_P2P_GO_MODE:
diff --git a/drivers/staging/qcacld-3.0/core/hdd/src/wlan_hdd_debugfs_csr.c b/drivers/staging/qcacld-3.0/core/hdd/src/wlan_hdd_debugfs_csr.c
index f3ceb75f3ef0..3020027e464c 100644
--- a/drivers/staging/qcacld-3.0/core/hdd/src/wlan_hdd_debugfs_csr.c
+++ b/drivers/staging/qcacld-3.0/core/hdd/src/wlan_hdd_debugfs_csr.c
@@ -327,7 +327,7 @@ void wlan_hdd_debugfs_csr_init(struct hdd_adapter *adapter)
 						 adapter->debugfs_phy,
 						 csr, &fops_csr_debugfs);
 		if (!csr->entry)
-			hdd_err("Failed to create generic_info debugfs file");
+			hdd_debug("Failed to create generic_info debugfs file"); // MOT IKSWQ-39460 abhkumar Error logs cleanup
 	}
 
 	csr = &adapter->csr_file[HDD_DEBUFS_FILE_ID_ROAM_SCAN_STATS_INFO];
@@ -339,7 +339,7 @@ void wlan_hdd_debugfs_csr_init(struct hdd_adapter *adapter)
 						 adapter->debugfs_phy,
 						 csr, &fops_csr_debugfs);
 		if (!csr->entry)
-			hdd_err("Failed to create generic_info debugfs file");
+			hdd_debug("Failed to create generic_info debugfs file"); // MOT IKSWQ-39460 abhkumar Error logs cleanup
 	}
 }
 
diff --git a/drivers/staging/qcacld-3.0/core/hdd/src/wlan_hdd_hostapd_wext.c b/drivers/staging/qcacld-3.0/core/hdd/src/wlan_hdd_hostapd_wext.c
index 89bb5de70db3..9bf4860b1ec1 100644
--- a/drivers/staging/qcacld-3.0/core/hdd/src/wlan_hdd_hostapd_wext.c
+++ b/drivers/staging/qcacld-3.0/core/hdd/src/wlan_hdd_hostapd_wext.c
@@ -345,15 +345,43 @@ static __iw_softap_setparam(struct net_device *dev,
 {
 	struct hdd_adapter *adapter = (netdev_priv(dev));
 	mac_handle_t mac_handle;
-	int *value = (int *)extra;
-	int sub_cmd = value[0];
-	int set_value = value[1];
+        //BEGIN MOT a19110 IKDREL3KK-11113 Fix iwpriv panic
+        int *value;
+	uint8_t *mot_value; //MOT a19110 IKLOCSEN-3014 Use copy from user
+        int sub_cmd;
+        int set_value;
+        int *tmp = (int *) extra;
+       //END IKDREL3KK-11113
 	QDF_STATUS status;
 	int ret = 0;
 	struct hdd_context *hdd_ctx;
 	bool bval = false;
 
 	hdd_enter_dev(dev);
+        //BEGIN MOT a19110 IKDREL3KK-11113 Fix iwpriv panic to 8998
+        //BEGIN MOT a19110 IKLOCSEN-3014 use copy_from_user to avoid junk value
+	if (tmp[0] < 0 || tmp[0] > QCSAP_SET_BTCOEX_LOW_RSSI_THRESHOLD) {
+            mot_value = (uint8_t *)kmalloc(wrqu->data.length+1, GFP_KERNEL);
+	    if(copy_from_user((uint8_t *) mot_value, (uint8_t *)(wrqu->data.pointer), wrqu->data.length)) {
+	        hdd_err("%s -- copy_from_user --data pointer failed! bailing",
+	                    __func__);
+		    kfree(mot_value);
+                    return -EFAULT;
+	    }
+	    sub_cmd = (int )(*(mot_value + 0));
+	    set_value = (int )(*(mot_value + 1));
+	    kfree(mot_value);
+        } else {
+               value = (int *)extra;
+	       sub_cmd = value[0];
+	       set_value = value[1];
+        }
+        //END IKLOCSEN-3014
+        if (!adapter || !adapter->hdd_ctx) {
+               hdd_err("Either hostpad adapter is null or Hal ctx is null");
+               return -EINVAL;
+        }
+        //END IKDREL3KK-11113
 
 	hdd_ctx = WLAN_HDD_GET_CTX(adapter);
 	ret = wlan_hdd_validate_context(hdd_ctx);
@@ -1406,7 +1434,7 @@ int __iw_softap_modify_acl(struct net_device *dev,
 			   union iwreq_data *wrqu, char *extra)
 {
 	struct hdd_adapter *adapter = (netdev_priv(dev));
-	uint8_t *value = (uint8_t *) extra;
+	uint8_t *value = (uint8_t *) kmalloc(wrqu->data.length+1, GFP_KERNEL); //MOT IKLOCSEN-3014
 	uint8_t peer_mac[QDF_MAC_ADDR_SIZE];
 	int list_type, cmd, i;
 	int ret;
@@ -1417,8 +1445,18 @@ int __iw_softap_modify_acl(struct net_device *dev,
 
 	hdd_ctx = WLAN_HDD_GET_CTX(adapter);
 	ret = wlan_hdd_validate_context(hdd_ctx);
-	if (0 != ret)
-		return ret;
+	if (0 != ret) {
+	    kfree(value); //MOT IKLOCSEN-3014
+	    return ret;
+	}
+	//BEGIN MOT a19110 IKLOCSEN-3014 use copy_from_user to avoid junk value
+	if(copy_from_user((uint8_t *) value, (uint8_t *)(wrqu->data.pointer), wrqu->data.length)) {
+	    hdd_err("%s -- copy_from_user --data pointer failed! bailing",
+	                       __func__);
+	    kfree(value);
+	    return -EFAULT;
+	}
+        //END IKLOCSEN-3014
 
 	ret = hdd_check_private_wext_control(hdd_ctx, info);
 	if (0 != ret)
@@ -1431,6 +1469,7 @@ int __iw_softap_modify_acl(struct net_device *dev,
 	i++;
 	cmd = (int)(*(value + i));
 
+        kfree(value);//MOT IKLOCSEN-3014
 	hdd_debug("Modify ACL mac:" QDF_MAC_ADDR_FMT " type: %d cmd: %d",
 	       QDF_MAC_ADDR_REF(peer_mac), list_type, cmd);
 
@@ -1522,17 +1561,23 @@ static __iw_softap_set_max_tx_power(struct net_device *dev,
 {
 	struct hdd_adapter *adapter = (netdev_priv(dev));
 	struct hdd_context *hdd_ctx;
-	int *value = (int *)extra;
+	uint8_t *mot_value;
 	int set_value;
 	int ret;
 	struct qdf_mac_addr bssid = QDF_MAC_ADDR_BCAST_INIT;
 	struct qdf_mac_addr selfMac = QDF_MAC_ADDR_BCAST_INIT;
 
 	hdd_enter_dev(dev);
-
-	if (!value)
+        mot_value = (uint8_t*)kmalloc(wrqu->data.length+1, GFP_KERNEL);
+	if (NULL == mot_value)
 		return -ENOMEM;
-
+        if(copy_from_user((uint8_t *)mot_value, (uint8_t *)(wrqu->data.pointer), wrqu->data.length)) {
+            hdd_err("%s -- copy from user -- data pointer failed! bailing", __func__);
+            kfree(mot_value);
+            return -EFAULT;
+        }
+        set_value = (int)(*(mot_value + 0));
+        kfree(mot_value);
 	hdd_ctx = WLAN_HDD_GET_CTX(adapter);
 	ret = wlan_hdd_validate_context(hdd_ctx);
 	if (0 != ret)
@@ -1546,8 +1591,7 @@ static __iw_softap_set_max_tx_power(struct net_device *dev,
 	qdf_copy_macaddr(&bssid, &adapter->mac_addr);
 	qdf_copy_macaddr(&selfMac, &adapter->mac_addr);
 
-	set_value = value[0];
-	if (QDF_STATUS_SUCCESS !=
+        if (QDF_STATUS_SUCCESS !=
 	    sme_set_max_tx_power(hdd_ctx->mac_handle, bssid,
 				 selfMac, set_value)) {
 		hdd_err("Setting maximum tx power failed");
@@ -1802,7 +1846,7 @@ static __iw_softap_disassoc_sta(struct net_device *dev,
 {
 	struct hdd_adapter *adapter = (netdev_priv(dev));
 	struct hdd_context *hdd_ctx;
-	uint8_t *peer_macaddr;
+	uint8_t *peer_macaddr = (uint8_t *)kmalloc(wrqu->data.length+1, GFP_KERNEL); //MOT IKLOCSEN-3014
 	int ret;
 	struct csr_del_sta_params del_sta_params;
 
@@ -1810,22 +1854,33 @@ static __iw_softap_disassoc_sta(struct net_device *dev,
 
 	if (!capable(CAP_NET_ADMIN)) {
 		hdd_err("permission check failed");
+		kfree(peer_macaddr); //MOT IKLOCSEN-3014
 		return -EPERM;
 	}
 
 	hdd_ctx = WLAN_HDD_GET_CTX(adapter);
 	ret = wlan_hdd_validate_context(hdd_ctx);
-	if (0 != ret)
+	if (0 != ret){
+		kfree(peer_macaddr); //MOT IKLOCSEN-3014
 		return ret;
-
+        }
 	ret = hdd_check_private_wext_control(hdd_ctx, info);
-	if (0 != ret)
+	if (0 != ret){
+		kfree(peer_macaddr); //MOT IKLOCSEN-3014
 		return ret;
+	}
 
 	/* iwpriv tool or framework calls this ioctl with
 	 * data passed in extra (less than 16 octets);
 	 */
-	peer_macaddr = (uint8_t *) (extra);
+       //BEGIN MOT a19110 IKLOCSEN-3014 use copy_from_user to avoid junk value
+       if(copy_from_user((uint8_t *) peer_macaddr, (uint8_t *)(wrqu->data.pointer), wrqu->data.length)) {
+               hdd_err("%s -- copy_from_user --data pointer failed! bailing",
+                         __func__);
+               kfree(peer_macaddr);
+               return -EFAULT;
+       }
+       //END IKLOCSEN-3014
 
 	hdd_debug("data " QDF_MAC_ADDR_FMT,
 		  QDF_MAC_ADDR_REF(peer_macaddr));
@@ -1834,7 +1889,7 @@ static __iw_softap_disassoc_sta(struct net_device *dev,
 					SIR_MAC_MGMT_DISASSOC,
 					&del_sta_params);
 	hdd_softap_sta_disassoc(adapter, &del_sta_params);
-
+        kfree(peer_macaddr); //MOT IKLOCSEN-3014
 	hdd_exit();
 	return 0;
 }
@@ -3081,6 +3136,13 @@ static const struct iw_priv_args hostapd_private_args[] = {
 	}
 	,
 #endif /* FW_THERMAL_THROTTLE_SUPPORT */
+	/* for moto SAR feature */
+	{
+		WE_SET_MIMO_TX_POWER,
+		IW_PRIV_TYPE_INT | MAX_VAR_ARGS,
+		0, "setTxPowerM"
+	}
+	,
 	/* handlers for main ioctl */
 	{
 		QCSAP_IOCTL_MODIFY_ACL,
diff --git a/drivers/staging/qcacld-3.0/core/hdd/src/wlan_hdd_main.c b/drivers/staging/qcacld-3.0/core/hdd/src/wlan_hdd_main.c
index 8ad1647c56fb..4e931c0f3f73 100644
--- a/drivers/staging/qcacld-3.0/core/hdd/src/wlan_hdd_main.c
+++ b/drivers/staging/qcacld-3.0/core/hdd/src/wlan_hdd_main.c
@@ -288,6 +288,17 @@ static int enable_11d = -1;
 static int enable_dfs_chan_scan = -1;
 static bool is_mode_change_psoc_idle_shutdown;
 
+#define BUF_LEN_SAR 10
+static char  sar_sta_buffer[BUF_LEN_SAR];
+static struct kparam_string sar_sta = {
+	.string = sar_sta_buffer,
+	.maxlen = BUF_LEN_SAR,
+};
+static char  sar_mhs_buffer[BUF_LEN_SAR];
+static struct kparam_string sar_mhs = {
+	.string = sar_mhs_buffer,
+	.maxlen = BUF_LEN_SAR,
+};
 #define WLAN_NLINK_CESIUM 30
 
 static qdf_wake_lock_t wlan_wake_lock;
@@ -12992,6 +13003,14 @@ struct hdd_context *hdd_context_create(struct device *dev)
 		goto err_release_store;
 	}
 
+	// BEGIN IKSWR-45692, support loading moto specific configurations
+	status = cfg_psoc_parse(hdd_ctx->psoc, WLAN_MOT_INI_FILE);
+	if (QDF_IS_STATUS_ERROR(status)) {
+		hdd_err("Failed to parse cfg %s, skip!",
+			WLAN_MOT_INI_FILE);
+	}
+	// END IKSWR-45692
+
 	hdd_cfg_params_init(hdd_ctx);
 
 	/* apply multiplier config, if not already set via module parameter */
@@ -13828,6 +13847,14 @@ static int hdd_initialize_mac_address(struct hdd_context *hdd_ctx)
 		return 0;
 	}
 
+#ifdef MOTO_UTAGS_MAC
+	hdd_warn("Can't update mac config via wlan_mac.bin, using MAC from serial number");
+
+	status = hdd_update_mac_serial(hdd_ctx);
+	if (QDF_IS_STATUS_SUCCESS(status))
+		return 0;
+#endif
+
 	hdd_info("using default MAC address");
 
 	/* Use fw provided MAC */
@@ -17716,6 +17743,11 @@ exit:
 	return errno;
 }
 
+static int sar_changed_handler(const char *kmessage,
+                                const struct kernel_param *kp)
+{
+        return param_set_copystring(kmessage, kp);
+}
 static int hdd_set_con_mode(enum QDF_GLOBAL_MODE mode)
 {
 	con_mode = mode;
@@ -19551,6 +19583,11 @@ static const struct kernel_param_ops fwpath_ops = {
 	.get = param_get_string,
 };
 
+static const struct kernel_param_ops sar_ops = {
+	.set = sar_changed_handler,
+	.get = param_get_string,
+};
+
 static int __pcie_set_gen_speed_handler(void)
 {
 	int ret;
@@ -19617,6 +19654,11 @@ module_param_cb(con_mode_epping, &con_mode_epping_ops,
 
 module_param_cb(fwpath, &fwpath_ops, &fwpath,
 		S_IRUSR | S_IWUSR | S_IRGRP | S_IROTH);
+module_param_cb(sar_sta, &sar_ops, &sar_sta,
+		S_IRUSR | S_IWUSR | S_IRGRP | S_IROTH);
+module_param_cb(sar_mhs, &sar_ops, &sar_mhs,
+		S_IRUSR | S_IWUSR | S_IRGRP | S_IROTH);
+
 
 module_param(enable_dfs_chan_scan, int, S_IRUSR | S_IRGRP | S_IROTH);
 
diff --git a/drivers/staging/qcacld-3.0/core/hdd/src/wlan_hdd_power.c b/drivers/staging/qcacld-3.0/core/hdd/src/wlan_hdd_power.c
index a5b8687f5c40..5c06a3660516 100644
--- a/drivers/staging/qcacld-3.0/core/hdd/src/wlan_hdd_power.c
+++ b/drivers/staging/qcacld-3.0/core/hdd/src/wlan_hdd_power.c
@@ -2636,8 +2636,7 @@ static int __wlan_hdd_cfg80211_set_power_mgmt(struct wiphy *wiphy,
 	if (hdd_adapter_is_connected_sta(adapter)) {
 		hdd_debug("vdev mode %d enable dhcp protection",
 			  adapter->device_mode);
-		allow_power_save ? hdd_stop_dhcp_ind(adapter) :
-			hdd_start_dhcp_ind(adapter);
+                allow_power_save ? hdd_stop_dhcp_ind(adapter) : hdd_start_dhcp_ind(adapter);
 	} else {
 		hdd_debug("vdev mod %d disconnected ignore dhcp protection",
 			  adapter->device_mode);
diff --git a/drivers/staging/qcacld-3.0/core/hdd/src/wlan_hdd_wext.c b/drivers/staging/qcacld-3.0/core/hdd/src/wlan_hdd_wext.c
index a273c996d0a0..c1748f863a0f 100644
--- a/drivers/staging/qcacld-3.0/core/hdd/src/wlan_hdd_wext.c
+++ b/drivers/staging/qcacld-3.0/core/hdd/src/wlan_hdd_wext.c
@@ -114,6 +114,7 @@
 #include "wlan_fwol_ucfg_api.h"
 #include "wlan_hdd_unit_test.h"
 #include "wlan_hdd_thermal.h"
+#include "wlan_hdd_sar_limits.h"
 
 /* Private ioctls and their sub-ioctls */
 #define WLAN_PRIV_SET_INT_GET_NONE    (SIOCIWFIRSTPRIV + 0)
@@ -973,6 +974,8 @@
  */
 #define WE_SET_CHANNEL                        88
 #define WE_SET_CONC_SYSTEM_PREF               89
+#define MAX_SUB_CMD                           91  // Motorola, IKDREL3KK-10418
+
 
 /*
  * <ioctl>
@@ -2530,6 +2533,9 @@
 #define WE_SET_TXRX_STATS    24
 
 
+/* for moto SAR features, support tx pwr limit settings on mimo device */
+#define WE_SET_MIMO_TX_POWER 32
+
 #ifdef FEATURE_WLAN_TDLS
 #undef  MAX_VAR_ARGS
 #define MAX_VAR_ARGS         11
@@ -5867,9 +5873,13 @@ static int __iw_set_three_ints_getnone(struct net_device *dev,
 				       union iwreq_data *wrqu, char *extra)
 {
 	struct hdd_adapter *adapter = WLAN_HDD_GET_PRIV_PTR(dev);
-	int *value = (int *)extra;
-	int sub_cmd = value[0];
-	int ret;
+	//BEGIN MOT a19110 IKSWL-15774 Ioctl from Mot code
+	int *value;
+	int sub_cmd, cmd_len;
+	int *tmp_value;
+	int *get_value = NULL;
+	int ret = 0;
+	//END IKSWL-15774
 	uint8_t dual_mac_feature = DISABLE_DBS_CXN_AND_SCAN;
 	struct hdd_context *hdd_ctx = WLAN_HDD_GET_CTX(adapter);
 	QDF_STATUS status;
@@ -5884,6 +5894,29 @@ static int __iw_set_three_ints_getnone(struct net_device *dev,
 	ret = wlan_hdd_validate_context(hdd_ctx);
 	if (0 != ret)
 		return ret;
+	//BEGIN MOT a19110 IKSWL-15774 Ioctl from Mot code
+	tmp_value = (int *)extra;
+
+	// Copy from wrqu structure if it was a ioctl from Motorola code
+	if(tmp_value[0] < 0 || (tmp_value[0] >= MAX_SUB_CMD)) {
+		cmd_len = wrqu->data.length;
+		get_value = (int *) kmalloc(cmd_len+1, GFP_KERNEL);  // Motorola, IKHSS7-39028
+
+		if(get_value == NULL)
+			return -ENOMEM;
+
+		if(copy_from_user((char *) get_value, (char*)(wrqu->data.pointer), cmd_len)) {
+			hdd_alert("copy_from_user --data pointer failed! bailing");
+			kfree(get_value);
+			return -EFAULT;
+		}
+
+		value = (int *)get_value;
+	} else {
+		value = (int *)extra;
+	}
+	sub_cmd = value[0];
+	//END IKSWL-15774
 
 	ret = hdd_check_private_wext_control(hdd_ctx, info);
 	if (0 != ret)
@@ -5928,6 +5961,11 @@ static int __iw_set_three_ints_getnone(struct net_device *dev,
 		break;
 
 	}
+
+	//BEGIN MOT a19110 IKSWL-15774 Ioctl from Mot code
+	if(get_value != NULL)
+		kfree(get_value);
+	//END IKSWL-15774
 	hdd_exit();
 	return ret;
 }
@@ -7383,6 +7421,81 @@ static int __iw_set_var_ints_getnone(struct net_device *dev,
 		break;
 	}
 #endif /* FW_THERMAL_THROTTLE_SUPPORT */
+
+	/* for moto SAR features, support tx pwr limit settings on mimo device */
+	case WE_SET_MIMO_TX_POWER:
+	{
+		struct sar_limit_cmd_params *sar_limit_cmd;
+		mac_handle_t mac_handle = hdd_ctx->mac_handle;
+		int ret = -EINVAL;
+		uint32_t num_limit_rows = 4;
+		struct sar_limit_cmd_row *row;
+
+		if (!mac_handle)
+			return -EINVAL;
+
+		sar_limit_cmd = qdf_mem_malloc(sizeof(struct sar_limit_cmd_params));
+		if (!sar_limit_cmd)
+			return -ENOMEM;
+
+		sar_limit_cmd->commit_limits = 1;
+		sar_limit_cmd->sar_enable = WMI_SAR_FEATURE_ON_USER_DEFINED;
+
+		row = qdf_mem_malloc(sizeof(*row) * num_limit_rows);
+		if (!row) {
+			qdf_mem_free(sar_limit_cmd);
+			hdd_err("Failed to allocate memory for sar_limit_row_list");
+			return -EINVAL;
+		}
+
+		//Below band/chain/limit_value number will get from Modem
+		//either CCK or OFDM, set the validity_bitmap as WMI_SAR_BAND_ID_VALID_MASK |WMI_SAR_CHAIN_ID_VALID_MASK
+		row[0].band_id = WMI_SAR_2G_ID; //WMI_SAR_2G_ID - 0; WMI_SAR_5G_ID - 1
+		row[0].chain_id = 0;
+		row[0].mod_id = WMI_SAR_MOD_OFDM;
+		row[0].limit_value = apps_args[0];
+		row[0].validity_bitmap = WMI_SAR_BAND_ID_VALID_MASK |WMI_SAR_CHAIN_ID_VALID_MASK;
+
+		row[1].band_id = WMI_SAR_2G_ID; //WMI_SAR_2G_ID - 0; WMI_SAR_5G_ID - 1
+		row[1].chain_id = 1;
+		row[1].mod_id = WMI_SAR_MOD_OFDM;
+		row[1].limit_value = apps_args[1];
+		row[1].validity_bitmap = WMI_SAR_BAND_ID_VALID_MASK |WMI_SAR_CHAIN_ID_VALID_MASK;
+
+		row[2].band_id = WMI_SAR_5G_ID; //WMI_SAR_2G_ID - 0; WMI_SAR_5G_ID - 1
+		row[2].chain_id = 0;
+		row[2].mod_id = WMI_SAR_MOD_OFDM;
+		row[2].limit_value = apps_args[2];
+		row[2].validity_bitmap = WMI_SAR_BAND_ID_VALID_MASK |WMI_SAR_CHAIN_ID_VALID_MASK |WMI_SAR_MOD_ID_VALID_MASK;
+
+		row[3].band_id = WMI_SAR_5G_ID; //WMI_SAR_2G_ID - 0; WMI_SAR_5G_ID - 1
+		row[3].chain_id = 1;
+		row[3].mod_id = WMI_SAR_MOD_OFDM;
+		row[3].limit_value = apps_args[3];
+		row[3].validity_bitmap = WMI_SAR_BAND_ID_VALID_MASK |WMI_SAR_CHAIN_ID_VALID_MASK |WMI_SAR_MOD_ID_VALID_MASK;
+
+		sar_limit_cmd->num_limit_rows = num_limit_rows;
+		sar_limit_cmd->sar_limit_row_list = row;
+		hdd_info("change pwr limit to [%d, %d, %d, %d].",
+					 row[0].limit_value, row[1].limit_value, row[2].limit_value, row[3].limit_value);
+		if (sme_set_sar_power_limits(mac_handle,sar_limit_cmd)
+		    != QDF_STATUS_SUCCESS) {
+			hdd_err("Setting maximum tx power failed");
+			if(sar_limit_cmd) {
+				qdf_mem_free(sar_limit_cmd->sar_limit_row_list);
+				qdf_mem_free(sar_limit_cmd);
+			}
+			ret = -EIO;
+			break;
+		}
+		else{
+			/* save settings in hdd_ctx, so can restore configs after SSR */
+			hdd_store_sar_config(hdd_ctx, sar_limit_cmd);
+			hdd_info("Setting maximum tx power successful");
+		}
+	}
+	break;
+
 	default:
 	{
 		hdd_err("Invalid IOCTL command %d", sub_cmd);
@@ -10020,6 +10133,11 @@ static const struct iw_priv_args we_private_args[] = {
 	 0,
 	 "ch_avoid"},
 #endif
+	/* for moto SAR features, support tx pwr limit settings on mimo device */
+	{WE_SET_MIMO_TX_POWER,
+	 IW_PRIV_TYPE_INT | MAX_VAR_ARGS,
+	 0,
+	 "setTxPowerM"},
 	/* handlers for main ioctl */
 	{WLAN_PRIV_FIPS_TEST,
 	 IW_PRIV_TYPE_BYTE | WE_MAX_STR_LEN,
diff --git a/drivers/staging/qcacld-3.0/core/sap/src/sap_module.c b/drivers/staging/qcacld-3.0/core/sap/src/sap_module.c
index a8dd5410829e..37e99e702888 100644
--- a/drivers/staging/qcacld-3.0/core/sap/src/sap_module.c
+++ b/drivers/staging/qcacld-3.0/core/sap/src/sap_module.c
@@ -844,6 +844,9 @@ QDF_STATUS wlansap_start_bss(struct sap_context *sap_ctx,
 		  pmac->sap.SapDfsInfo.sap_ch_switch_mode,
 		  pmac->sap.SapDfsInfo.reduced_beacon_interval);
 
+	//BEGIN MOT a19110 IKSWO-8490 Comment out initialisation of
+	//acl list. We use driver ioctl to set it
+#if 0
 	/* Copy MAC filtering settings to sap context */
 	sap_ctx->eSapMacAddrAclMode = config->SapMacaddr_acl;
 	qdf_mem_copy(sap_ctx->acceptMacList, config->accept_mac,
@@ -854,7 +857,10 @@ QDF_STATUS wlansap_start_bss(struct sap_context *sap_ctx,
 		     sizeof(config->deny_mac));
 	sap_ctx->nDenyMac = config->num_deny_mac;
 	sap_sort_mac_list(sap_ctx->denyMacList, sap_ctx->nDenyMac);
-	sap_ctx->beacon_tx_rate = config->beacon_tx_rate;
+#endif
+        //END IKSWO-8490
+        sap_ctx->beacon_tx_rate = config->beacon_tx_rate;
+
 
 	/* Fill in the event structure for FSM */
 	sap_event.event = eSAP_HDD_START_INFRA_BSS;
@@ -2331,11 +2337,11 @@ void wlansap_extend_to_acs_range(mac_handle_t mac_handle,
 	}
 
 	if (*end_ch_freq <= wlan_reg_ch_to_freq(CHAN_ENUM_2484)) {
-		*bandEndChannel = CHAN_ENUM_2484;
+		*bandEndChannel = CHAN_ENUM_2472;
 		tmp_end_ch_freq = (*end_ch_freq + ACS_2G_EXTEND) <=
-					wlan_reg_ch_to_freq(CHAN_ENUM_2484) ?
+					wlan_reg_ch_to_freq(CHAN_ENUM_2472) ?
 					(*end_ch_freq + ACS_2G_EXTEND) :
-					wlan_reg_ch_to_freq(CHAN_ENUM_2484);
+					wlan_reg_ch_to_freq(CHAN_ENUM_2472);
 	} else if (*end_ch_freq <= wlan_reg_ch_to_freq(CHAN_ENUM_5885)) {
 		*bandEndChannel = CHAN_ENUM_5885;
 		tmp_end_ch_freq = (*end_ch_freq + ACS_5G_EXTEND) <=
diff --git a/drivers/staging/qcacld-3.0/core/wma/src/wma_features.c b/drivers/staging/qcacld-3.0/core/wma/src/wma_features.c
index 03a51f01fbd4..dcd409da821b 100644
--- a/drivers/staging/qcacld-3.0/core/wma/src/wma_features.c
+++ b/drivers/staging/qcacld-3.0/core/wma/src/wma_features.c
@@ -72,6 +72,11 @@
 #include <wlan_crypto_global_api.h>
 #include "cdp_txrx_host_stats.h"
 
+// IKSWS-90973 BEGIN
+#include <linux/fdtable.h>
+#include <linux/signal.h>
+// IKSWS-90973 END
+
 /**
  * WMA_SET_VDEV_IE_SOURCE_HOST - Flag to identify the source of VDEV SET IE
  * command. The value is 0x0 for the VDEV SET IE WMI commands from mobile
@@ -2032,6 +2037,87 @@ wma_wow_get_pkt_proto_subtype(uint8_t *data, uint32_t len)
 	}
 }
 
+// IKSWS-90973 BEGIN, print the process that causing the wow wakeup
+static int wow_check_task = 0;
+module_param(wow_check_task, int, 0644);
+MODULE_PARM_DESC(wow_check_task, "Check wow wakeup process");
+
+static void check_task(uint16_t dport)
+{
+	struct task_struct *p = NULL;
+	struct file *file = NULL;
+	struct files_struct *files = NULL;
+	struct inode *inode = NULL;
+	struct socket *sock = NULL;
+	struct sock *sk = NULL;
+	struct inet_sock *inet = NULL;
+	struct fdtable *fdt = NULL;
+	int i = 0;
+
+	for_each_process(p)
+	{
+		files = p->files;
+		if (files != NULL) {
+			spin_lock(&files->file_lock);
+			for (i = 0; i < NR_OPEN_DEFAULT; i++)
+			{
+				file = rcu_dereference(files->fd_array[i]);
+				if (file != NULL) {
+					inode = file_inode(file);
+					if (inode && S_ISSOCK(inode->i_mode)) {
+						sock = file->private_data;
+					} else {
+						sock = NULL;
+					}
+					if (sock) {
+						sk = sock->sk;
+						if (!sk)
+							continue;
+						if (sk->sk_family == AF_INET || sk->sk_family == AF_INET6) {
+							inet = inet_sk(sock->sk);
+							if(inet->inet_sport == dport) {
+								wma_info("task pid[%d], comm[%s], inet_sport[%u], inet_dport[%u]",
+										p->pid, p->comm, qdf_cpu_to_be16(inet->inet_sport), qdf_cpu_to_be16(inet->inet_dport));
+								spin_unlock(&files->file_lock);
+								return;
+							}
+						}
+					}
+				}
+			}
+			fdt = files_fdtable(files);
+			for (i = 0; i < fdt->max_fds; i++) {
+				file = rcu_dereference_check_fdtable(files, fdt->fd[i]);
+				if (!file)
+					continue;
+				inode = file_inode(file);
+				if (inode && S_ISSOCK(inode->i_mode)) {
+					sock = file->private_data;
+				} else {
+					sock = NULL;
+				}
+				if (sock) {
+					sk = sock->sk;
+					if (!sk)
+						continue;
+					if (sk->sk_family == AF_INET || sk->sk_family == AF_INET6) {
+						inet = inet_sk(sock->sk);
+						if(inet->inet_sport == dport) {
+							wma_info("task pid[%d], comm[%s], inet_sport[%u], inet_dport[%u]",
+									p->pid, p->comm, qdf_cpu_to_be16(inet->inet_sport), qdf_cpu_to_be16(inet->inet_dport));
+							spin_unlock(&files->file_lock);
+							return;
+						}
+					}
+				}
+			}
+			spin_unlock(&files->file_lock);
+		}
+	}
+	wma_info("No process have the dport[%u]", qdf_cpu_to_be16(dport));
+}
+// IKSWS-90973 END
+
 static void wma_log_pkt_eapol(uint8_t *data, uint32_t length)
 {
 	uint16_t pkt_len, key_len;
@@ -2106,6 +2192,10 @@ static void wma_log_pkt_ipv4(uint8_t *data, uint32_t length)
 		qdf_cpu_to_be16(pkt_len),
 		qdf_cpu_to_be16(src_port),
 		qdf_cpu_to_be16(dst_port));
+	// IKSWS-90973 BEGIN
+	if (wow_check_task)
+		check_task(dst_port);
+	// IKSWS-90973 END
 }
 
 static void wma_log_pkt_ipv6(uint8_t *data, uint32_t length)
@@ -2137,6 +2227,10 @@ static void wma_log_pkt_ipv6(uint8_t *data, uint32_t length)
 		 qdf_cpu_to_be16(pkt_len),
 		 qdf_cpu_to_be16(src_port),
 		 qdf_cpu_to_be16(dst_port));
+	// IKSWS-90973 BEGIN
+	if (wow_check_task)
+		check_task(dst_port);
+	// IKSWS-90973 END
 }
 
 static void wma_log_pkt_tcpv4(uint8_t *data, uint32_t length)
diff --git a/drivers/staging/qcacld-3.0/get_value_from_xml.py b/drivers/staging/qcacld-3.0/get_value_from_xml.py
new file mode 100644
index 000000000000..c46b21f50aa1
--- /dev/null
+++ b/drivers/staging/qcacld-3.0/get_value_from_xml.py
@@ -0,0 +1,28 @@
+#! /usr/bin/env python3
+#coding=utf-8
+
+def main():
+    import os
+    import sys
+    import xml.etree.ElementTree as ET
+    import argparse
+
+    parser = argparse.ArgumentParser()
+    parser.add_argument('xml', help = 'xml path')
+
+    args = parser.parse_args()
+
+    fp = args.xml
+    if not os.path.exists(fp):
+        print("Error: file '%s' not exist"%(fp), file=sys.stderr)
+    tree = ET.parse(fp)
+    root = tree.getroot()
+    for i in root.findall("./builds_flat/build"):
+        d = {}
+        for j in i:
+            d[j.tag] = j.text
+        if d.get("name") == "wlan":
+            print(d["linux_root_path"])
+
+if __name__=="__main__":
+    main()